The adversarial attack in ITS has been studied under the context of recognition tasks for traffic signs [1]} and licence plates [2]}, and control and coordination of the vehicle platoon [3]}. However, its influence on traffic state prediction has not been receiving equal attention [4]}. In this paper, we propose an adversarial attack framework to degrade network-wide, multi-step traffic state prediction models by treating the model as a black-box, i.e., we assume no knowledge of the model architecture, training data, and (hyper)parameters. Nevertheless, we assume the adversary can oracle a deployed model (i.e., the target model) using arbitrary input to obtain its output. The input-output pairs are then used to train a substitute model to mimic the target model's behaviors. Next, adversarial signals are generated based on the substitute model via Fast Gradient Sign Method (FGSM) [5]} and Basic Iterative Method (BIM) [6]}, respectively. Using the transferability property [7]}, the adversary then attacks the target model using the produced adversarial signals with the goal to degrade the target model's prediction performance.
